A court-records platform must forbid anonymous API access and require authenticated subjects for any authorized action. Which statement matches Kubernetes authorization posture?
Select an answer to reveal the explanation.
Short Explanation
The courthouse API starts locked: no badge, no filing. Authenticated identity alone is not a free pass—you still need an explicit binding for the verbs you use. Anonymous callers should not silently get view across the cluster.
Full Explanation
Kubernetes RBAC is deny-by-default for authorization: without a matching allow rule via bindings (or another authorizer), requests are forbidden even if authentication succeeds. Administrators grant access by binding Roles or ClusterRoles to users, groups, or ServiceAccounts. Anonymous access is not implicitly granted view, and NetworkPolicies govern pod network traffic—not kubectl authentication to the API server.